Skip to content

Commit 023466a

Browse files
abdilahrfabdilahrf
committed
📚 Add sCTF Skeleton
1 parent 972cd4b commit 023466a

File tree

22 files changed

+632
-0
lines changed

22 files changed

+632
-0
lines changed

‎sCTF-2015/README.md

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# sCTF 2015 Write-ups
2+
3+
* <http://compete.sctf.io/>
4+
* [Scoreboard](http://compete.sctf.io/scoreboard.php)
5+
6+
## Completed write-ups
7+
8+
* [Flufferduff](coding/Flufferduff)
9+
* [aGFtcHduZXIz](crypto/aGFtcHduZXIz)
10+
* [Cipherception](crypto/Cipherception)
11+
* [Coney](crypto/coney)
12+
* [Crib Drag](crypto/Crib Drag)
13+
* [I Like Bacon](crypto/I Like Bacon)
14+
* [MD5](crypto/MD5)
15+
* [MD5_2](crypto/MD5_2)
16+
* [qes](crypto/qes)
17+
* [Cruel Guessing Game](pwnable/Cruel Guessing Game)
18+
* [Deceptive Ports](pwnable/Deceptive Ports)
19+
* [Graphics Interchange Format](steganography/Graphics Interchange Format)
20+
* [Hello World](trivia/Hello World)
21+
* [Survey](trivia/Survey)
22+
* [That Sounds Delicious](trivia/That Sounds Delicious)
23+
* [Every 7 Seconds](web/Every 7 Seconds)
24+
* [Impromptu GET](web/Impromptu GET)
25+
* [strpos](web/strpos)
26+
27+
## Incomplete write-ups
28+
29+
30+
* [Simple Guessing Game]()
31+
* [Not-So-Simple-Guessing Game]()
32+
* [Busy Beaver Problem]()
33+
* [The Turing Machine WWII]()
34+
* [180 Degrees]()
35+
* [No Yen To Use]()
36+
* [Big Real Estate]()
37+
* [1.21 Warp]()
38+
* [```<h1></h1>```]()
39+
* [Overflow]()
40+
* [Cookies]()
41+
* [SQL]()
42+
* [196-Algorithm World]()
43+
* [Overflow 2]()
44+
* [Degrees Kelvin]()
45+
* [Obfuscated Python]()
46+
* [Acoustician]()
47+
* [Bob's Private Server]()
48+
* [Large Numbers]()
49+
* [The Numberic Approach]()
50+
51+
52+
##Competitors
53+
54+
* Felipe Faria - [sync](https://github.com/Synchronizing)
55+
* Alejandro Lucena - [hincoin](https://github.com/Hincoin)
56+
* Richard Liu - [Dracae](https://github.com/Dracae)
57+
* Zonshen Yu - [Muggist](https://github.com/Muggist)

‎sCTF-2015/coding/Flufferduff/README.md

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Flufferduff
2+
3+
**Category:** Coding
4+
**Points:** 20
5+
**Author:**
6+
**Description:**
7+
8+
>We here at sCTF enjoy weird words.
9+
>
10+
>Let *(n) = d(n) - x(n) where x(n) is the sum of all odd numbers above 0 and before n, exclusive, and d(n) is the sum of all primes in the range of (0,n), exclusive.
11+
>
12+
>When *(n) is negative, we call this a flufferduff.
13+
>
14+
>Find the number of flufferduffs below 1000.
15+
16+
17+
## Write-up
18+
19+
This problem is one of the more self-explanatory ones.
20+
[Flufferduff Pastebin](http://pastebin.com/YgLBpNE5)
21+
22+
If your code doesn't work, sucks... I ain't bug-fixin dat shizzle.
23+
24+
If you brute forced the problem, I salute you!
25+
26+
##Flag
27+
>991
28+
29+
## Other write-ups and resources
30+
31+

‎sCTF-2015/crypto/Cipherception/README.md

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Cipherception
2+
3+
**Category:** Crypto
4+
**Points:** 35
5+
**Author:**
6+
**Description:**
7+
8+
>OCBnbCB0bCAxMCBmZGFuIHlkIGxkIFlndiBydnogYmQgcG1qcHpkX2Z4Y3liY3R2X2FibGxiY2w=
9+
10+
>5Affine2 > 8Caesar > Atbash > B64
11+
12+
## Writeup
13+
14+
To begin solving the problem one must recognize that all the plain-text words given within the problems are simple encryption methods. With this in mind, and the obvious direction of the arrow, one can backtrack the ciphers to gain the plain-text.
15+
16+
>B64 > Atbash > 8Caesar > 5Affine2
17+
18+
19+
```
20+
Base64: 8 gl tl 10 fdan yd ld Ygv rvz bd pmjpzd_fxcybctv_abllbcl
21+
```
22+
23+
Once the Atbash had been obtain, the chain of decryption is kept going:
24+
```
25+
Atbash: 8 to go 10 uwzm bw ow Bte iea yw knqkaw_ucxbyxge_zyooyxo
26+
```
27+
28+
Atbash to Caesar with shift of 8:
29+
```
30+
8Caesar: 8 lg yg 10 more to go Tlw aws qo cficso_muptqpyw_rqggqpg
31+
```
32+
33+
Affine with A coefficient of 5, B coefficient of 2. User had to remove all unnecessary plaintexts before running throgh Affine.
34+
35+
```
36+
Caesar: Tlw aws qo cficso_muptqpyw_rqggqpg
37+
Affine: The key is always_continue_digging
38+
```
39+
40+
The key has now been successfully extracted.
41+
42+
## Flag
43+
>always_continue_digging
44+
45+
## Other write-ups and resources

‎sCTF-2015/crypto/Crib Drag/README.md

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Crib Drag
2+
3+
**Category:** Crypto
4+
**Points:** 35
5+
**Author:**
6+
**Description:**
7+
8+
>2d0710181b01111f0817171401071c11091a0a
9+
>3c091311111a1a0e180003120d1a0811091a0a
10+
11+
## Writeup
12+
13+
Using our google-fu, two very great resources emerge... [link 1](http://travisdazell.blogspot.com/2012/11/many-time-pad-attack-crib-drag.html) [link 2](https://cryptocult.wordpress.com/cyber-challenges/stanford-cryptography-i-programs/program-1/)
14+
15+
16+
After loading the python in, we start guessing cribs.
17+
```
18+
"the" gives nothing good.
19+
"you" gives "hav". We should try "have"
20+
"have" gives "youl". We should try "youll"
21+
"youll" gives "havef". We should try "havefun"
22+
"havefun" gives "youllne". We should try "youllnever"
23+
"youllnever" gives "havefungue". We should try "havefunguessing"
24+
"havefunguessing" gives "youllneverguess"
25+
```
26+
It looks like part of our plaintext messages are "havefunguessing" and "youllneverguess", with the end missing. The missing part is the same though, "11091a0a". We should assume "11091a0a" = "this", so our messages are "havefunguessingthis" and "youllneverguessthis"
27+
28+
29+
That's pretty much it. To find the key, we just xor the hex of our plain text with the encrypted to get the flag.
30+
```
31+
xor 2d0710181b01111f0817171401071c11091a0a with 796f756c6c6e65766572677565737374686973
32+
output 54686574776f74696d65706164746f65617379
33+
hextoascii 54686574776f74696d65706164746f65617379 to Thetwotimepadtoeasy
34+
```
35+
36+
## Flag
37+
>Thetwotimepadtoeasy
38+
39+
## Other write-ups and resources
40+
41+

‎sCTF-2015/crypto/I Like Bacon/README.md

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#I Like Bacon
2+
3+
**Category:** Crypto
4+
**Points:** 15
5+
**Author:**
6+
**Description:**
7+
8+
>... .- -- ..- . .-.. ..--.- -- --- .-. ... . ..--.- .. ... ..--.- -.-. --- --- .-.. ..--.- -... ..- - ..--.- -... .- -.-. --- -. ..--.- .. ... ..--.- -.-. --- --- .-.. . .-. ..--.- -... .- .- -... -... .- .- -... -... -... .- -... .- .- .- -... .- .- -... .- .- -... .- .- .- -... .- .- -... .- -... .- .- -... -... .- .- -... -... -... .- .- -... .- .- .- .- -... .- -... .- -... .- -... -... .- .- .- .- .- .- .- -... -... .-
9+
10+
11+
## Writeup
12+
This is a cryptography question. Looking at it, the question appears to be in [morse code](http://en.wikipedia.org/wiki/Morse_code). Plugging that into a morse code decrypter, we get the following message:
13+
14+
```
15+
SAMUEL MORSE IS COOL BUT BACON IS COOLER BAABBAABBBABAAABAABAABAAABAABABAABBAABBBAABAAAABABABABBAAAAAAABBA
16+
```
17+
18+
The returned string seems to contain some sort of diss and a new ciphered text.
19+
20+
```
21+
BAABBAABBBABAAABAABAABAAABAABABAABBAABBBAABAAAABABABABBAAAAAAABBA
22+
```
23+
24+
Looking up [Bacon cipher](http://en.wikipedia.org/wiki/Bacon%27s_cipher), we find what the second message was encoded with. Utilizing an online decipher we receive the flag.
25+
26+
## Flag
27+
28+
>THISISTHEFLAG
29+
30+
## Other write-ups and resources
31+
32+

‎sCTF-2015/crypto/MD5/README.md

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# MD5
2+
3+
**Category:** Crypto
4+
**Points:** 30
5+
**Author:**
6+
**Description:**
7+
8+
>Given the following MD5 hash:
9+
10+
>0AB1A9222A15DA1159EB94212C5C8BAF
11+
12+
>There are 3 parts to the original text. The first part is a random number, 0-99 inclusive. The second part is a random letter, lowercase a-z inclusive. The third and final part is a random number, 0-999 inclusive.
13+
14+
>For example, 19f599 or 0a159 could be possible combinations. There are no 0's for blank spaces, for example 0a001 is not valid. It would be 0a1.
15+
16+
>Find the original text.
17+
18+
## Writeup
19+
After been given an MD5 hash the user could either attempt to brute-force it, or utilise an online service to attempt to find the plain-text matching the hashed one.
20+
21+
Attempting to bruteforce it would take several hours depending on software utilised, and thus using an online database is the best option between the two (or at least worth a try).
22+
23+
Simply pasting the MD5 into [HashKiller.co.uk](http://www.hashkiller.co.uk/md5-decrypter.aspx) the user receives the flag.
24+
25+
## Flag
26+
>15q478
27+
28+
## Other write-ups and resources

‎sCTF-2015/crypto/MD5_2/README.md

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# MD5_2
2+
3+
**Category:** Crypto
4+
**Points:** 40
5+
**Author:**
6+
**Description:**
7+
8+
>Given the following MD5 hash:
9+
10+
11+
>2E561F52DF1F1A31B5C4A00D0C846728
12+
13+
14+
>And that the alphanumeric all lowercase text is less than 8 characters, find the original text (the flag).
15+
16+
## Writeup
17+
Very similiar to the first MD5 problem, the user could either attempt to bruteforce the MD5 hash or simply look within online databases.
18+
19+
Simply pasting the MD5 into [HashKiller.co.uk](http://www.hashkiller.co.uk/md5-decrypter.aspx) the user receives the flag.
20+
21+
## Flag
22+
>581qq92
23+
24+
## Other write-ups and resources

‎sCTF-2015/crypto/aGFtcHduZXIz/README.md

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# aGFtcHduZXIz
2+
3+
**Category:** Crypto
4+
**Points:** 40
5+
**Author:**
6+
**Description:**
7+
8+
>[Boop](http://pastebin.com/yEUZWrRd)
9+
10+
## Writeup
11+
12+
Wow, can they get anymore cryptic? xP
13+
First task: Figure out the title
14+
15+
>aGFtcHduZXIz > Base64 > hampwner3
16+
17+
Looks like a username. Let's use our google-fu and check out the results.
18+
We find a [Youtube](https://www.youtube.com/user/hampwner3) , a [RoosterTeeth](http://roosterteeth.com/hampwner3) and a [Quizlet](http://quizlet.com/hampwner3) ...
19+
20+
Trying the Youtube and RoosterTeeth doesn't get us anywhere, but the Quizlet contains a clue... Sir hampwner3's [spanish quiz](http://quizlet.com/11856164/spanish-cards-flash-cards/) has a [youtube link](https://www.youtube.com/watch?v=jlcTNS2TUhg) as the last term.
21+
22+
Navigating to the video, we see Lux Ion's comment ...
23+
>Wow cool video! フラグはハムです。
24+
25+
This roughly translates to ...
26+
> Flag is ham.
27+
28+
## Flag
29+
>ham
30+
31+
## Other write-ups and resources

‎sCTF-2015/crypto/coney/README.md

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Coney
2+
3+
**Category:** Crypto
4+
**Points:** 60
5+
**Author:**
6+
**Description:**
7+
8+
>![coney](coney.gif "Coney")
9+
10+
##Solution
11+
12+
Due to the name of the problem, the most logical thing to do was simply Google ```Graphics Interchange Format``` which would lead the user to the wikipedia page [GIF](http://en.wikipedia.org/wiki/GIF). After reading a bit one would notice the header (```47 49 46 38 37 61```) and the terminating (```3B```) hex of a standart GIF. After consulting a trusty hex editor it was noticed that while the header was correct, the terminating hexadecimal was not.
13+
14+
Due to the incorrect terminating hexadecimal one would assume that the file was merged with something else. After utilising wikipedia's page on [List of file signatures](http://en.wikipedia.org/wiki/List_of_file_signatures) and comparing possible files that could have merged, it was found a compressed file was is the cause.
15+
16+
Simply opening the file using WinZip, Winrar, or 7-Zip prompted a file name ```x```. The file contained:
17+
18+
>U2FsdGVkX1/seMYknjQGW971EboRgFcx+jfczzdSrWMjt1xwRrPnQBbEsz+Mt7dA4xxsOVB88e8VGl70
19+
20+
After some research on possible ciphers utilising the gif's content as reference, the user would've stumble upon the [Rabbit Cipher](http://en.wikipedia.org/wiki/Rabbit_%28cipher%29). Utilising a online rabid decipher and the key ```rabbit``` as guessed through the content of the image, the following was retrieved:
21+
22+
>The key is who_knew_there_is_a_rabbit_cipher
23+
24+
25+
##Flag
26+
27+
>who_knew_there_is_a_rabbit_cipher
28+
29+
## Other write-ups and resources

‎sCTF-2015/crypto/coney/coney.gif

494 KB
Loading

‎sCTF-2015/crypto/qes/README.md

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Q.E.S.
2+
3+
**Category:** Crypto
4+
**Points:** 80
5+
**Author:**
6+
**Description:**
7+
8+
>![seq](seq.png "seq")
9+
10+
11+
## Writeup
12+
13+
Cryptic problem time! Where to start... We focus on the file name of the picture, seq.png. We assume seq stands for sequence, and we conclude the pattern in QES utilizes sequences. However when we try plugging the numbers into https://oeis.org/ , no known sequence is found. We have to assume that QES contains multiple sequences.
14+
15+
Anytime you have sequences, look for fibonacci numbers. CTFs LOVE fibonacci. Here I have highlighted the fibonacci terms I see...
16+
17+
![redSeq](http://tinyurl.com/qem7mgb "redSeq")
18+
19+
A suspiciously nice pattern... Every third term starting from the first is part of the fibonacci sequence. We try every third term starting from the second, and with the guiding hand of https://oeis.org/ we discover this second sequence is the lucas sequence! Finally, every third term starting from the third number forms the pentagonal numbers sequence.
20+
21+
![coloredSeq](http://tinyurl.com/qxsebx7 "coloredSeq")
22+
23+
From here, we need to complete the grid, a trivial task.
24+
25+
![fullColoredSeq](http://s16.postimg.org/pwvjc7g5x/QES.png "fullColoredSeq")
26+
27+
The flag is just the rest of the grid.
28+
29+
13 29 70 21 47 92 34
30+
76 117 55 123 145 89 199
31+
176 144 322 210 233 521 247
32+
33+
##Flag
34+
35+
>13297021479234761175512314589199176144322210233521247
36+
37+
## Other write-ups and resources
38+

‎sCTF-2015/crypto/qes/seq.png

2.49 KB
Loading

‎sCTF-2015/pwnable/Cruel Guessing Game/README.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Cruel Guessing Game
2+
3+
**Category:** Pwnable
4+
**Points:** 55
5+
**Author:**
6+
**Description:**
7+
8+
>I'm thinking of an integer between 1 and 1000.
9+
>
10+
>python.sctf.io:11236
11+
>
12+
>My number is randomly generated each time you guess.
13+
14+
## Solution
15+
16+
http://pastebin.com/hnJ4c4Mr
17+
18+
## Flag
19+
>thatwascruel
20+
21+
## Other write-ups and resources

0 commit comments

Comments
 (0)